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VISIT PRECIS 

BERNARD BAR BIER 

(PHONETIC: bear-XARbar-BYAY) 

Technical Director 

Directorate lor External Security (DGSE), France 

PATRICK PA ILL OCX 

(PHONETIC : pali-TREEK pie-YOO) 

Director 

National Information Systems Security (ANSSI), France 

12 April 2013 



Guests Arrive at GH2B' 1030 

Technical Presentation and Discussions: (1045-1215) 

DDIR-Hosted Lunch. (1215-1300) 

NSOC Courtesy Call (1300-1330) 

NIOC Courtesy Call- (1330-1430) 

DIRXSA Courtesy - Call: (1430-1500) 



(U) BAC KGROUND: 

• (TS ST NT) Mr. Barbier and Mr. Patrick Pailloux will travel to NSA on 12 April 2013 to 
share information regarding May 2012 cyber attacks on the French Presidential network 
In November 2012. a French magazine revealed information about the attacks and 
accused the U.S. of being responsible. During a January 2013 visit. unbeknownst to FAD 
Desk Officers and SUSLAF, DGSE and ANSSI questioned DIRXSA about the cyber 
attacks and asked about U S involvement DIRNSA denied U £ involvement and offered 
NSA's assistance to France in attributing the attacks. Two (2) NSA'CSS Threat 
Operations Center (XTOC) Analysts were prepared to travel to Paris in March to provide 
support to the French, DGSE and ANSSI canceled the meeting the day before the team 
was scheduled to depart and instead, requested a visit to NSA on 12 April For this visit, 
Mr. Barbie r and Mr. Piiiloux will be accomp anied by : 
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( U ) PURPOSE OF THE VISIT: 

• (TS SI NF) Mr. Earbier and Mr. Pailloux will present technical details of the cyber 
attacks against the French Presidential network from May 2012 Mr Barbier and Mr 
Paillonx will meet with senior leaders and analysts from NTQC. SID. lAD. and FAD in 
hopes that NSA can help with attribution. 

(U) VISITOR REQUESTED: 

• (S REL TO USA. FRA) DGSE and ANSSI requests help in attributing the cyber attacks 
against the French Presidential network in May 2012 

(U> CDR DCDR/DDIR GUIDANCE: NA 

(U) PREP SESSION GUIDANCE: 

• (TS' SI NF} Prep sessions are scheduled forDIRNSA and D DIR on 12 April. A 
timeline of events will be prepared that describes the cyber attack, the claims by French 
media, discussions with DIRN5A. and steps NSA has taken to support the Partner 

(11NSA CSS REQUESTED: 

• (S ' REL TO USA, FRA) T echnical data associated with the cyber attacks against the 
french Presidential network. To date, no advance information has been shared with NSA. 

(U) CYBERCOM REQUESTED: N/A 

(U> COMMON THREADS: 

• (S . RJEL TO USA. FRA) Stress the potential value of the NSA-DGSE ANSSI partnership 
through timely cyber defense exchanges 

(U> KEY TOPIC AREAS: 

• (U- TOUO) Computer Network Defense (CXD) 

(U) KEY TAKEAWAYS: 

• (5/vREL TO USA t FRA} DIRECTORATE’S ROLE : Recommend DTRNSA 
emphasize the following point: 
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* (S.REL TO USA, FRA) CND C ollabo ration; Reiterate the need for continued 
dose cooperation on CND efforts and emphasize the importance of DGSE and 
ANSSf collaboration to leverage SIGINT to support CND. 



(U) VISIT FORMAT: 

• (S'. REL USA. FRA) Mr. Barbier and Mr. Pailloux will lead a technical discussion 
relating to the May 1012 cyber attacks against the French Presidential network D-DIR 
will host lunch and Courtesy Calls arc scheduled with N&OC. NTGC and DIRNSA. 

• S REL TO USA, FRA) N S A participant s indud e . DIRFA, NTOC D IR, IA DIR, SID 
DIR. SUSLAF. FAD Desk Officers. Analysts. and technical Target experts. 

a 1 ) PREVIOUS VISITS AND RESPECTIVE TOPICS: 

• (S REL USA. FRA ) Mr. Barbier last visited N’$A in May 20 12 for the Strategic 
Planning Conference Mr Pailfoux last visited NSA in February" 201 1: this visit focused 
on cyber issues. 

(U) POTENTIAL LANDMINES: 

• CIS ST NT ) There is a chance that helping attribute the cyber attacks against the French 
Presidential network may reveal a U.S. ally is responsible. 

• (TS SI NF) The French have not been forthcoming in sharing technical details of the 
cyber attacks There is suspicion that the information is not being shared prior to the visit 
because the French want to see how NSA responds when they present their Findings. 
During the January 20 1.3 DIRNSA visit to Paris, both DGSE and ANSSI asked GEN 
Alexander about the cyber attacks in an attempt to ascertain whether or not the U.S. was 
responsible for the attacks (as reported in French magazines). At no time was FAD made 
aware that DGSE and ANSSI intended to raise the issue with DIRNSA. 

<U) OTHER INFORMATION: 

• (TS.- ST NF) TAO confirmed that this was not a TAO operation TAO asked most of 
NSA = s dose 1 Party Partners whether they were involved (CIA, GCHQ. and CSEC 
were the mostly likely suspects); everyone has dented involvement. TAO intentionally 
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did not ask either Mo s sad or ISNU whether they were involved as France is not an 
approved target for joint discussion 

* (S 'NF) After repeated requests for technical information relating to the cyber attacks (in 
advance of the visit). ANSSI and DGSE have not provided any details. 

c n RECENT PRESS INDICATIONS: 

• (U) The cyber attacks against the French Presidential network took place in May 2012. 

An initial press report from Paris Allannco, "Tre nch Website Says Turki s h Hack ers 
Behind Elvsee Cyber Attacks /' dated 12 July 2012. stated it was believed “the attacks 
originated from France’s allies ’ and speculated Turkish hackers with possible links to 
Turkish ''intelligence services or government bodies " might be responsible. No follow on 
press reports have been seen that place blame on Turkey. A press report from Paris 

l 'Express, “ French Weekly Reports on Alleged US Cyber Espionage Attack on Elvsee 
Palace .' dated 20 November 2012 t shifted blame for the attacks toward the United States 
On 27 November 2012. ‘Qn’etsur images contacted the^mir L Express author who 
shared there are an “array of assumptions" that enable pointing to the United States as the 
origin of this attack. Paris L 'Express contacted AXSSI and the Elysee. both declined to 
comment. 
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